Aug 4 – August 6, 2026
- The Iran-linked water-sector campaign expanded to at least 12 states, with South Dakota and Georgia the newest to report OT incidents (earlier coverage; The Record, Schneier). · Aug 6 · observed · Threat Activity
threat actor · not yet in the cluster map
iran
3 stories · 3 in the wild · July 16, 2026 – August 6, 2026
evidence: 3 observed
how they got in
- sms 1 · Jul 16
sectors
- energy 2 · Aug 6
- critical infrastructure 1 · Aug 6
- defense 1 · Jul 16
geography
- united states 3 · Aug 6
- georgia 1 · Aug 6
- south dakota 1 · Aug 6
- iran 1 · Aug 1
- finland 1 · Jul 16
- middle east 1 · Jul 16
techniques
- exploitation 1 · Jul 16
- geolocation 1 · Jul 16
attack phases seen
- Impact 1 · Aug 1
- Collection 1 · Jul 16
- Reconnaissance 1 · Jul 16
what we reported, newest first, grouped by story
August 1, 2026
- U.S. intelligence agencies assess Iran was likely behind the coordinated attack on 30+ Minnesota municipal water systems, marking an attribution shift on the campaign tracked in earlier coverage. CISA issued a public alert urging operators to pull internet-exposed PLCs and other OT offline immediately (The Record, Washington Post). · Aug 1 · observed · Threat Activity
July 16, 2026
- Iran abused long-known SS7 telecom vulnerabilities to geolocate U.S. military and contractor personnel in the Middle East in the run-up to and early days of the conflict, according to FT reporting on Mobile Surveillance Monitor research. Finland's NCSC flagged the report. NCSC-FI/TechCrunch, SC World · Jul 16 · observed · via sms · Threat Activity